631–640 of 702 posts
> Today’s announcement proves that cybercriminals can no longer hide behind perceived global anonymity Anyone know what the loose end was that got these guys busted?
If they were dumb enough to waste such a high value target on a small scale bitcoin scam then I wouldn’t be surprised if they were dumb enough to perform the malicious actions from their home IP address.
Earlier quoted context omitted.
From memory, I recall the FBI did a study, and found that half of their employees would plug in a USB drive that they found on the ground in the parking lot. After training, that number was reduced to a quarter. If a security-focused government police agency is so vulnerable, it is unreasonable to expect perfection from a (less paranoid) company.
Anecdote: working at a court room I was bemused by the security talks about usb keys, yet the OS setup still allows usb driver installs automatically (granted their local presence). I know because I brought a keyboard to replace the busted one they had in-house and windows gladly set up everything plug`n`play. I wonder if OSes have actual rules for this, and if there are secure corporate usb keys
https://docs.microsoft.com/en-us/windows/security/threat-pro...
Earlier quoted context omitted.
Having bad security is not criminal. If it was we wouldn't have a voting village at defcon cracked by pre-teens and there would be a lot more irresponsible CEO's in prison (so probably a better world).
Negligence is actionable regardless of whether it’s criminal. And whether it’s criminal depends on the duty of care that can be reasonably expected from the negligent party. In this case, I’ll leave the expected duty of care to your imagination, but I’ll point out that we’re talking about a publicly-traded multinational corporation with many millions of users including governments and world leaders.
Earlier quoted context omitted.
The age of the attacker is irrelevant to Twitter's role in this story. However your underlying point still stands. If we want these types of attacks to stop, we can't just let all these companies off with a public embarrassment being the primary punishment. At a certain point we have to start calling it negligence when companies fall for these attacks and fail to have proper precautions in place to prevent them.
From memory, I recall the FBI did a study, and found that half of their employees would plug in a USB drive that they found on the ground in the parking lot. After training, that number was reduced to a quarter. If a security-focused government police agency is so vulnerable, it is unreasonable to expect perfection from a (less paranoid) company.
Earlier quoted context omitted.
The sentences should run concurrently. 4 years for setting a car on fire is not unreasonable, although maybe a little harsh depending on priors. It's a dangerous thing to do. But setting five cars on fire is not particularly worse than setting one car on fire.
What about murdering 5 people vs 1 person? Although I would agree in this case and the rationale would be that it probably would take not much more amount of time to adjust behaviour of someone who did 5 vehicles vs 1. But maybe something like 7 years instead.
Earlier quoted context omitted.
It would be nice if SEC were this dogged in its pursuit of actual insider trading.
It is. Insider trading is one of the few things it is really good at prosecuting - mostly because it's dead-easy to identify, easy to prove, often performed by idiots, and has a lot of incredibly-well established law surrounding it that makes turning piles of evidence into jail time easy. None of these reasons hold for other financial crimes, which is why there are so few bankers and executives going to jail for ever…
Earlier quoted context omitted.
Anecdote: working at a court room I was bemused by the security talks about usb keys, yet the OS setup still allows usb driver installs automatically (granted their local presence). I know because I brought a keyboard to replace the busted one they had in-house and windows gladly set up everything plug`n`play. I wonder if OSes have actual rules for this, and if there are secure corporate usb keys
You know you can create USB device filters in Windows so it will not allow unknown device to be installed. But sysadmin has to know about it. https://docs.microsoft.com/en-us/windows/security/threat-pro...
thanks for the tip
Earlier quoted context omitted.
Can you elaborate on how this makes things more secure (assuming HTTPS) Surely if the server accepts a client side hash of a password, then the hash has become the password
Off the top of my mind. Maybe it could be something like that: 1. Api gives user a fixed salt. 2. User types password into input. 3. Client hashes and sends hash to server. 4. Server has another salt and uses the client sent hash to hash it again. 5. This final hash is compared what is in the database. This way server never has knowledge of the original PW and it's never sent over the network. This reduces for instan…
Earlier quoted context omitted.
The sentences should run concurrently. 4 years for setting a car on fire is not unreasonable, although maybe a little harsh depending on priors. It's a dangerous thing to do. But setting five cars on fire is not particularly worse than setting one car on fire.
What about murdering 5 people vs 1 person? Although I would agree in this case and the rationale would be that it probably would take not much more amount of time to adjust behaviour of someone who did 5 vehicles vs 1. But maybe something like 7 years instead.